Amazon SES Easy DKIM
Amazon SES DkimStatus PENDING: DKIM records not detected
SES Easy DKIM verification needs all three exact CNAME owner and target pairs from the selected identity and Region. Check the complete published set before waiting on the SES console or changing a sender identity.
Amazon SES keeps the identity in a pending DKIM state:
DkimStatus: PENDING
Run this automated test on my domain
Enter your domain. MailFixIt checks the relevant DNS records automatically and shows the evidence.
What to enter
- The selected SES Region.
- All three exact Easy DKIM CNAME owner/target pairs shown for the identity.
- The domain that owns those selectors.
What the check confirms
- Match: the public CNAME has the provider-issued target.
- Mismatch or absent: at least one required public DNS member differs or cannot be found.
- Bounded result: public DNS is compared only with the values you supply. The checker never guesses an SES target or claims that the SES console has refreshed.
After all three records match, allow SES time to detect them, then check the same identity in the same Region. AWS may continue searching for the records for up to 72 hours. This page covers Easy DKIM; BYODKIM uses a TXT public key instead.
Frequently asked questions
Why does Amazon SES provide three Easy DKIM CNAME records?
SES rotates and manages DKIM signing keys through the complete provider-issued record set. Publish all three exact owner and target pairs for the selected identity and Region.
Does a public DNS match guarantee that SES will immediately show Verified?
No. A DNS match confirms publication, while the SES console has its own verification timing and Region-specific identity state. Recheck the same identity in the same Region.
Related email diagnostics
Primary sources: Amazon SES Easy DKIM.